Ebay’s fraud team tricked by phony e-mail

A sophisticated phishing attack has proven to be so successful, it has tricked eBay’s own fraud investigations team into endorsing it as legitimate, according to an independent security consultant who reported the attack to eBay.

In late November, Richi Jennings received a fraudulent e-mail message containing the subject line “Christmas is Coming on ebay.co.uk.” Offering him “great tips for successful Christmas selling,” the message directed him to the Web site ebaychristmas.net, which then asked Jennings to enter his eBay user name and password, as well as the name and password for his e-mail account.

Jennings reported the site to eBay on Nov. 25, and four days later he got a note back from the company’s investigations team claiming that the e-mail message was, in fact, “an official e-mail message sent to you on behalf of e-Bay.”
Jennings was dumfounded. He immediately wrote back to eBay pointing out that the Web site being used was clearly fraudulent, but his e-mail went unanswered.

On Monday, an eBay spokeswoman confirmed that the e-mail message was indeed part of a fraud, but she could not explain why it had initially been identified as legitimate. “I don’t know the answer to that,” said spokeswoman Amanda Pires. “I’m assuming right now it was just an error.”

From their initial response, it appeared that eBay’s investigators did not take his concerns seriously, Jennings said. “They never actually used the word idiot, but I felt like they were calling me an idiot,” he said. He believes that the e-mail message in question bore such a close resemblance to a legitimate eBay message that the company’s investigators were simply tricked by the scam.

Full Story

More Info from Richi Jennings at richi.co.uk

Related posts:

1. Florida Men Accused Of eBay Mail Fraud
2. Royal Mail crackdown on lost mail auctions
3. Russian eBay fraud website closed down
4. Drug Dealers and Robbers turn to eBay fraud
5. eBay Scam Artists using My Message